lusrmgr.msc: Complete Guide to Local Users and Groups in Windows

QUICK ANSWER

lusrmgr.msc opens the Local Users and Groups management console in supported Windows editions. It lets administrators create, rename, disable, delete, and configure local user accounts, as well as control membership in local security groups such as Administrators and Remote Desktop Users.

The console manages accounts stored on one Windows computer; it does not manage Microsoft Entra ID or Active Directory domain accounts centrally. It is generally available in Windows Pro, Enterprise, Education, and supported Windows Server editions, but not Windows Home. Administrative permission is required for most changes.

What Is lusrmgr.msc?

lusrmgr.msc is the Microsoft Management Console snap-in for managing Local Users and Groups. Its filename is derived from “local user manager.”

A local account is created and authenticated by an individual Windows device. Its permissions normally apply only to that computer. Windows stores local account and group information in its local Security Accounts Manager database.

The console provides two principal areas:

The tool is particularly useful on standalone computers, workstations, lab systems, kiosks, and servers that require device-specific accounts.

System Requirements and Limitations

Supported Windows editions

The Local Users and Groups snap-in is normally included with:

• Windows 10 and Windows 11 Pro
• Windows 10 and Windows 11 Enterprise
• Windows 10 and Windows 11 Education
• Supported Windows Server editions

It is not included with Windows Home editions. On Windows Home, opening lusrmgr.msc normally displays a message stating that the snap-in cannot be used with that version of Windows.

Do not download an unofficial replacement merely to imitate the missing snap-in. Use Windows Settings, Control Panel, the supported net user command, or available PowerShell account-management commands instead.

What lusrmgr.msc does not manage

The console is not a replacement for:

• Active Directory Users and Computers
• Microsoft Entra ID administration
• Microsoft 365 user management
• Group Policy
• NTFS file and folder permissions
• User profiles and their stored data
• Microsoft account subscriptions or cloud security settings

A domain account can sometimes be placed into a local group on a domain-joined computer, but the account itself remains managed by the domain.

How lusrmgr.msc Works

Windows uses security principals—including users and groups—to assign rights and permissions. Every account receives a security identifier, or SID. Windows permissions are associated primarily with this SID rather than the visible account name.

A local group collects multiple security principals under a common set of permissions. When a user becomes a group member, the user receives the rights and resource access granted to that group, subject to applicable security policies and explicit deny permissions.

For example:

• A standard local user receives limited system privileges.
• A member of the local Administrators group can perform administrative operations after elevation.
• A member of Remote Desktop Users may sign in through Remote Desktop if Remote Desktop and applicable policies permit it.
• A disabled account remains defined but cannot be used for sign-in.

Group membership changes might not affect an already signed-in session immediately. Signing out and signing back in—or restarting the relevant process or computer—may be necessary to obtain a refreshed access token.

How to Open Local Users and Groups

Method 1: Use the Run dialog

1. Press Windows key + R.
2. Enter:

lusrmgr.msc

3. Press Enter.
4. Approve the User Account Control prompt if Windows displays one.

Method 2: Use Computer Management

1. Right-click Start.
2. Select Computer Management.
3. Expand System Tools.
4. Select Local Users and Groups.

Method 3: Use Windows Search

Search for Edit local users and groups or lusrmgr.msc, and then open the matching result.

Verify your Windows edition

If the snap-in is missing, press Windows key + R, enter winver, and press Enter. Check whether the computer runs a Home, Pro, Enterprise, or Education edition.

Understanding the Users Folder

The Users folder can contain accounts created by administrators, accounts associated with Microsoft accounts, and built-in or system-managed accounts.

Typical properties include:

Available options can vary by Windows version, account type, and security policy.

Built-in and system-managed accounts

Windows may display accounts such as Administrator, Guest, DefaultAccount, or WDAGUtilityAccount. Their availability and status depend on the installed Windows features and version.

Do not enable, delete, rename, or repurpose unfamiliar system-managed accounts without understanding their function. The built-in Administrator and Guest accounts are commonly disabled by default for security reasons.

How to Create a Local User

Administrator permission is normally required.

1. Open lusrmgr.msc.
2. Select Users.
3. Right-click an empty area and select New User.
4. Enter a user name.
5. Optionally enter a full name and description.
6. Enter and confirm a strong, unique password.
7. Select the required password options.
8. Click Create, and then click Close.

The new account is normally a standard user unless you add it to a privileged local group.

Recommended configuration

For an ordinary user:

• Keep the account out of the Administrators group.
• Require a password that complies with organizational policy.
• Use a descriptive account name and description.
• Require a password change at first sign-in when an administrator assigned the initial password.
• Set an expiration date through an appropriate supported administration method for genuinely temporary accounts.

Avoid creating passwordless accounts. Local security policy or organizational controls may also prevent them from being used for remote or network access.

How to Add a User to a Local Group

1. Open lusrmgr.msc.
2. Select Groups.
3. Double-click the required group.
4. Click Add.
5. Enter the user or group name.
6. Click Check Names to validate it.
7. Click OK, and then OK again.

Alternatively:

1. Open Users.
2. Double-click the user.
3. Open the Member Of tab.
4. Click Add and select the required group.

Important warning about Administrators

Members of the local Administrators group can gain extensive control over the computer, including the ability to install software, change security settings, access protected data, and manage other accounts.

Grant administrative membership only when required. Microsoft specifically recommends limiting the number of users in the Administrators group.

Where practical, give each administrator:

• A standard account for everyday work
• A separate administrative account for elevated tasks

Common Local Groups

Exact groups vary according to the Windows edition, installed roles, and enabled features.

Group membership alone may not be sufficient. A service must be enabled, network access must be allowed, and local or domain policies may grant or deny the associated sign-in right.

Managing Existing Accounts

Rename an account

1. Open Users.
2. Right-click the account.
3. Select Rename.
4. Enter the new name.

Renaming changes the visible name but does not create a new SID. Existing permissions tied to the SID generally remain associated with the account.

Renaming an account does not necessarily rename its existing profile directory under C:\Users. Manually renaming a profile directory can break profile references and is not recommended as a routine account-renaming method.

Change or reset a password

Right-click the account and select Set Password.

A password reset performed by an administrator is different from a user changing a known password. Windows warns that forcibly resetting a password can cause loss of access to certain protected information, including files encrypted with the Encrypting File System, stored credentials, and some personal certificates.

Use normal password-change procedures whenever the user still knows the current password. Use an administrative reset only when necessary and after considering the data-loss warning.

Disable an account

1. Double-click the account.
2. Select Account is disabled.
3. Click OK.

Disabling is usually safer than immediate deletion when an employee leaves, an account is under investigation, or its future need is uncertain. It blocks new sign-ins while preserving the account’s SID and current permission assignments.

Existing sessions may remain active until they are signed out or otherwise terminated.

Delete an account

1. Right-click the account.
2. Select Delete.
3. Review the warning carefully.
4. Confirm the deletion.

Deletion is a high-impact action:

• Recreating an account with the same name creates a different SID.
• Old permissions can appear as unresolved SIDs.
• The associated user profile and data may remain on the disk.
• Files owned by the deleted account may require an administrator to take ownership.
• Deleting an account from this console is not a reliable data-erasure method.

Back up required data and record group memberships and permissions before deletion.

Secure PowerShell Alternatives

Run Windows PowerShell as an administrator for operations that modify accounts or groups. The Microsoft.PowerShell.LocalAccounts module supplies supported local-account cmdlets.

The module is not available from 32-bit PowerShell on a 64-bit Windows system. Use the 64-bit Windows PowerShell host in that situation.

List local users

Get-LocalUser

Inspect one account

Get-LocalUser -Name "SupportUser"

Create an account securely

$Password = Read-Host "Enter password" -AsSecureString
New-LocalUser -Name "SupportUser" `
    -Password $Password `
    -FullName "Support User" `
    -Description "Temporary support account"

This approach avoids placing the clear-text password directly in the command history.

Add the account to a local group

Add-LocalGroupMember -Group "Remote Desktop Users" -Member "SupportUser"

Built-in group names can be localized on non-English Windows installations. For automation across different display languages, design and test SID-aware management rather than assuming that English group names always exist.

Verify group membership

Get-LocalGroupMember -Group "Remote Desktop Users"

Disable and re-enable an account

Disable-LocalUser -Name "SupportUser"
Enable-LocalUser -Name "SupportUser"

Remove a local account

Remove-LocalUser -Name "SupportUser"

Confirm backups and dependencies before running the removal command.

Command Prompt Alternatives

The built-in net user command can display and manage local accounts.

List local user accounts

net user

Display account details

net user SupportUser

Create an account without exposing the password

net user SupportUser * /add

The asterisk prompts securely for the password.

Add the user to a group

net localgroup "Remote Desktop Users" SupportUser /add

Disable an account

net user SupportUser /active:no

Re-enable an account

net user SupportUser /active:yes

Delete an account

net user SupportUser /delete

Run modifying commands from an elevated Command Prompt. Group names may differ on localized Windows installations.

Benefits of lusrmgr.msc

Centralized local account administration

The console brings user properties and group memberships into one interface, reducing the need to remember commands.

Clear visibility

Administrators can quickly inspect:

• Which local accounts exist
• Which accounts are disabled
• Which users belong to privileged groups
• Whether an account is locked out
• Which account restrictions are configured

Easier permission management

Assigning permissions to groups is more scalable than assigning them separately to every user. A person’s effective access can be changed by updating group membership.

Improved troubleshooting

The console can help identify common account problems such as:

• A disabled account
• Missing group membership
• Unexpected membership in Administrators
• A locked-out account
• Incorrect account restrictions

Safer offboarding

An administrator can disable an account immediately and review its access before deciding whether to remove it permanently.

No additional installation

On supported Windows editions, it is a built-in administrative component and does not require third-party account-management software.

Security Best Practices

• Apply least privilege: use standard accounts unless administrative rights are required.
• Keep membership in Administrators and other privileged groups minimal.
• Never share administrative accounts between multiple people.
• Use unique passwords and follow current organizational password policy.
• Prefer disabling and investigating an account before deleting it.
• Document the owner, purpose, and expected lifetime of service or temporary accounts.
• Review local users and privileged group membership regularly.
• Do not enable the Guest account as a general sharing solution.
• Avoid the Password never expires setting for normal users unless an approved technical requirement exists.
• Do not store clear-text passwords in scripts, tickets, documentation, or command history.
• Use centrally managed identities and policies where an organization needs consistent administration across many computers.
• Maintain at least one tested, authorized recovery method before changing administrator accounts.

How to Verify a Change

After making a change:

1. Refresh the console by selecting Action > Refresh or pressing F5.
2. Reopen the user or group properties and confirm the setting.
3. Use PowerShell for an independent check:

Get-LocalUser -Name "SupportUser"
Get-LocalGroupMember -Group "Remote Desktop Users"

4. Sign out and sign back in if group membership changed.
5. Test the intended access using the affected account without granting unnecessary additional permissions.

Do not test a new administrator account by removing or disabling your only known working administrator first.

Troubleshooting lusrmgr.msc

“This snap-in may not be used with this edition of Windows”

The computer is probably running Windows Home. Verify the edition with winver. Use Windows Settings, net user, or supported PowerShell commands instead. Upgrading the Windows edition is only necessary if features exclusive to another edition are genuinely required.

Local Users and Groups is missing from Computer Management

Possible causes include:

• Windows Home is installed.
• The console is connected to a target that does not expose the expected node.
• Administrative tools or MMC use is restricted by organizational policy.
• Windows system files or the MMC configuration are damaged.

First verify the Windows edition and try opening lusrmgr.msc directly. On an organization-managed device, contact the system administrator rather than attempting to bypass policy.

“Access is denied”

The current account or process does not have sufficient permission. Sign in with an authorized administrator account or start the management tool through an approved elevated process.

A new user cannot perform administrative tasks

New users are not automatically administrators. Add the account to Administrators only if administrative access is genuinely required. Otherwise, keep it as a standard user and supply approved administrator credentials when elevation is needed.

Group membership does not appear to work

Sign out and sign back in so Windows can create a new access token. Also verify that:

• The correct account was added.
• The required service or feature is enabled.
• User-rights assignments do not deny the requested sign-in type.
• Domain or mobile-device-management policy has not overridden the local setting.
• Firewall and network requirements are satisfied for remote access.

An account was deleted but its profile remains

Account deletion and profile deletion are separate operations. Back up required files before removing the profile through supported Windows profile-management controls. Do not simply delete a profile directory unless you understand the associated registry and data implications.

A user name is shown as an unresolved SID

The account associated with that SID may have been deleted or may currently be unavailable. Creating another account with the same name does not restore the old SID. Review the permission entry and replace it with the correct current security principal where appropriate.

When to Use an Alternative

Use Windows Settings for simple account additions or account-type changes by ordinary users.

Use PowerShell for repeatable administration, auditing, remote workflows, and scripted deployment.

Use Active Directory, Microsoft Entra ID, Group Policy, or an endpoint-management platform when accounts and access must be managed consistently across many devices.

Use Local Users and Groups when you need detailed, interactive control over accounts and groups stored on one supported Windows computer.

FAQ

Frequently Asked Questions

Is lusrmgr.msc available in Windows 11 Home?

No. The native Local Users and Groups MMC snap-in is not included with Windows Home. Use Windows Settings, supported command-line tools, or upgrade to an appropriate Windows edition if its additional business features are required.

Does lusrmgr.msc manage Microsoft accounts?

It can display and manage some local properties of an account connected to a Microsoft account, but it does not manage the Microsoft account itself, its cloud password, subscriptions, or online security settings.

Can I manage domain users with lusrmgr.msc?

Not centrally. The tool manages the local account database and local groups of a computer. On a domain-joined machine, authorized domain principals can be added to certain local groups, but their domain identities are managed through domain tools.

Do I need administrator rights?

Viewing may be possible with limited rights in some configurations, but creating, modifying, disabling, deleting, or changing group membership normally requires administrative authorization.

Is a member of the Administrators group always running with full privileges?

Not necessarily. With User Account Control enabled, an administrator normally works with a filtered access token and must approve or authenticate elevation for administrative operations.

Does deleting a user also delete its files?

Not reliably. The user profile and data can remain on disk. Account removal should therefore be planned separately from profile archiving or deletion.

Why did a group-membership change not take effect immediately?

The user’s existing sign-in session may still have an older access token. Sign out and sign back in to obtain a token containing the updated group memberships.

Is disabling an account better than deleting it?

Disabling is usually safer when the change may need to be reversed or when permissions and data still require review. Deletion is appropriate only after backups, ownership, access dependencies, and retention requirements have been addressed.

Can lusrmgr.msc reset a forgotten password?

An authorized administrator can reset a local account password, but the reset can make certain user-protected information inaccessible. Use the user’s normal password-change or approved recovery process where possible.

FINAL RECOMMENDATION / CONCLUSION

Use lusrmgr.msc for detailed, interactive management of local accounts and security groups on supported Windows editions. Keep ordinary users as standard users, tightly control privileged group membership, disable questionable or departed-user accounts before deleting them, and verify important changes after a fresh sign-in.

For Windows Home, use supported Windows Settings, PowerShell, or net user methods instead of unofficial snap-in replacements. For organizations managing multiple computers, prefer centralized identity, policy, and endpoint-management systems over independent local-account administration.

#lusrmgr #Windows11 #Windows10 #LocalUsers #LocalGroups #WindowsAdministration #UserAccounts #SystemAdministration #ITSupport #WindowsSecurity #PowerShell #CommandPrompt #ComputerManagement #AdministratorsGroup #LocalAccount #AccessControl #Troubleshooting #Cybersecurity

SOURCES

• Microsoft Learn — Local accounts
• Microsoft Learn — Get-LocalUser
• Microsoft Learn — New-LocalUser
• Microsoft Learn — Add-LocalGroupMember
• Microsoft Learn — net user